Privacy Policy

1. Who we are

This service is operated by PLAYYOURWAYHOSTING (ABN 33 985 231 059), trading as Play Your Way Hosting. We provide game-server hosting: you subscribe to a plan, and we provision and run a game server for you on dedicated servers in the location you choose when you buy it. This policy covers both our websites, playyourway.com.au and playyourwayhosting.com.

We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). For visitors in the EEA or UK, the GDPR supplement in section 10 also applies. Privacy questions: support@playyourway.com.au.

2. Information we collect

• Account information - your name, email address and, if you upload one, an avatar image. Passwords are handled by our authentication provider and are never visible to us in plain text. We also keep, with your account, the page you first landed on and the site that sent you there (domain only), so we can understand which searches bring customers; this sets no cookie.
• Billing information - payment is processed by our payment processor. We store their reference for you as a customer and your invoice history; we never store full card numbers.
• Service data - the servers you provision and their configuration, backups you create, and your support tickets and live-chat conversations.
• Account activity - when you sign in (time and a running count) and when you last used your dashboard. We use this for security review and support, and so we can tell an active account from an abandoned one. When we show you the review popup, and if you close it, we also note when and how many times, so it waits before asking again and we can count how many customers saw it; that goes when you delete your account.
• Optional Discord link - if you connect Discord, we store your Discord user ID to link the accounts. You can unlink at any time from your account page.
• Friend referrals - if you share your referral link, the page it opens shows the first word of your account name to anyone who opens it, so your friend knows who sent it. If you claim a friend's link and sign up, we record whose link it was so you both get your free month.
• Reviews you post - only if you choose to review us from your dashboard: your star rating, anything you wrote, the name you chose to show (your first name and last initial, a nickname, or none), the game you host, and when you posted or edited it. To keep it to one review credit per payment card, we also store the fingerprint our payment processor gives each of your saved cards: a code that is the same for the same card, never the card number.
• Technical data - IP addresses and basic request logs used for rate limiting, abuse and fraud prevention, and to keep the service secure. Guest live-chat sessions record the IP they were started from for spam prevention.
• Cookie-consent records - when you make a choice in the cookie banner, or claim a friend's referral link (which switches on referral attribution only), we keep a record of it: a random identifier (the same one stored in your own browser), which of the two optional categories you allowed (referral attribution, and analytics with session replay), the version of the notice you were shown, and the time. We deliberately do not log your IP address, device or browser against it - proving a privacy decision should not mean collecting more data than the decision itself. If you were signed in at the time, the record is linked to your account.
• Product analytics and session replay - only if you switch analytics on in the cookie banner. Our analytics provider records which pages you visited and what you clicked, and builds a replay of how you moved through the interface, against a random analytics id and, while you are signed in, against your account. What you type is recorded as you typed it, except passwords: anything entered into a password field is replaced with asterisks in your browser before it is sent, the passwords the panel can reveal to you are hidden the same way, and two-factor setup is left out entirely. Every figure on your billing pages is masked. The rest of what you see, including your server console, the file manager, database and SFTP screens, support tickets and live chat, is recorded as it appeared on your screen, and the console can include lines about your server’s players. Messages your browser writes to its developer console are recorded with the replay. We use replays to find where the site confuses people and to work out what went wrong when you ask for help. Nothing is collected until you switch it on, and switching it off stops it immediately. Our Cookie Policy explains exactly what a replay does and does not capture.
• Launch-interest contacts - if you ask to be notified when a game goes live, or you back a game request, we store the one contact you typed in (an email address or a Discord username) against that game and the time you asked. Nothing else - no name, no IP address, and it is not linked to an account. We use it for that one message and nothing else, we have never sent anything from these lists, and you can ask us to remove your contact at any time by emailing support@playyourway.com.au.
• Daily visit totals - when one of our game, plan or checkout pages loads, your browser tells our server which page it was, the name of the website that sent you (for example google.com, never the full address) and the source label in the link if it had one, and our server adds one to that page's count for the day. Only the daily totals per page and per kind of source (search engine, AI assistant, direct, another website, or a click inside our site) are kept. No cookie is set or read, nothing is stored on your device, and no IP address, browser details or identifier is kept, so a count can never be traced back to you. That is why it is not behind a consent switch.
• Which parts of the server panel you use - when you open a tab in your server's panel (Console, Files, Backups and so on) or press one of its main buttons (start, restart, create a backup, upload files and a few others), we record which one, when, for which of your servers and against your account. We use it only to learn which parts of the panel people rely on and which they never touch, so we know what to improve or remove. Nothing is stored on your device, and no IP address or browser details are kept with it. Clicks on the demo panel on our home page are counted the same way but with no account or server attached.
• Help Centre feedback - when you tell us whether a guide helped, we store your yes or no against that guide together with a code made from your IP address, the guide and the date. We do not store the IP address itself, the code changes every day, and it is not linked to your account; it only stops the same visitor voting twice on one guide in a day.
• Product events from our own systems - a short, fixed list of things that happen on your account (you signed up, a subscription started or was cancelled, a server was provisioned, a power action ran, a backup was taken, a ticket was opened). These are sent from our server rather than your browser, keyed only to your account id, and they are not controlled by the cookie banner - see section 10 for the legal basis and how to object.
• Fault reports from the machines that run game servers - if a server runs out of memory, keeps crashing or fails to install, the machine running it reports that fault to our analytics provider. A report identifies the server and the machine, never you or your account, and is not controlled by the cookie banner. Reports cannot be deleted one server at a time, so what is held is removed when it reaches the 1 year analytics retention in section 6. To object, email us and we will stop them.
• Which advert or link first brought you here - when you first arrive, a small first-party cookie of our own remembers the campaign labels in the address you arrived on (the ones we put in our own adverts and links), the page you landed on and the website that sent you, for 30 days. If you then create an account, that record is kept against it, and if you place an order the campaign labels are noted on the order. It holds no identifier, nothing is sent to any advertising network, and it is used for one thing: telling whether the money we spend on advertising brings in customers. See our Cookie Policy.

What we do not do: we run no advertising trackers, no ad networks and no social-media pixels; we do not build advertising profiles; we do not sell or share personal information for anyone else’s marketing; and nothing we use follows you to other websites. We do run product analytics and session replay, through an analytics provider in the European Union, but only if you switch it on - it is off until you do, and you can switch it back off at any time.

3. How we use your information

• To create and manage your account, and to provision and operate your servers.
• To process payments, renewals and refunds through our payment processor.
• To send transactional email (verification, billing, server status, support replies).
• To send you a welcome email, and - if you are a customer - to ask you once for a public review. These are the only emails we send that are not strictly about running your account, they each carry an unsubscribe link, and unsubscribing stops them without affecting anything above. We run no newsletter, no mailing list and no marketing campaigns, and we never email people who are not customers.
• To provide support and respond to your enquiries.
• If you post a review, to publish it on our reviews page with the name you chose, tagged as having earned a credit, and to give you its $5 credit and track where it went.
• To see which help guides actually help, so we can rewrite the weak ones.
• To secure the service - rate limiting, fraud and abuse prevention, and investigating incidents.
• To meet legal obligations, including tax and consumer-law record keeping.

4. Cookies and similar technologies

We use essential cookies (sign-in session, checkout fraud prevention, live-chat continuity) and two optional categories that are only ever switched on by you: referral attribution, and product analytics with session replay. They are separate switches. The full list, durations, exactly what a replay records, and how to change your mind are in our Cookie Policy.

5. Third parties we share with

We share personal information only as needed to run the service, with service providers in these categories:

• Payment processing - taking payments and refunds, and card fraud prevention.
• Authentication, database and file storage - your sign-in and the data behind your account.
• Email delivery - sending transactional email.
• Network security and content delivery - protecting the site from attacks and serving it quickly, including a page-view counter that shows how many people visit and which pages they land on. It is not the same thing as the analytics in the cookie banner: it sets no cookie, stores nothing on your device, gives you no identifier and cannot follow you between visits or between sites, so there is nothing about you for it to build a profile from. That is also why it is not behind a consent switch.
• Product analytics and session replay - processed in the European Union. It receives nothing at all from your browser unless you have switched analytics on.
• Error reporting - so a crash on your screen reaches us with enough detail to fix it.
• Infrastructure and game-server management - the dedicated servers your game server runs on, in the location you chose for it, and the software that provisions and runs them. If you choose a location outside Australia, your server, its files and its backups are stored in that country.
• Discord - only if you sign in with Discord or link your Discord account (privacy policy).
• Browser push services - only if you opt in to push notifications, your browser’s push endpoint (Google, Mozilla or Apple, depending on your browser) receives the messages we send you.

Reviews are public. A review you post appears on our reviews page for anyone to read: your rating, your words, the name you chose, the game you host and the month. A rating with no words only counts towards the average there, with nothing about you shown. Nothing else about you is shown with a review.

Each provider is bound to use the information only to provide its service to us. A current list of our service providers is available on request: email support@playyourway.com.au. We may also disclose information where required by law. We do not sell your personal information to anyone.

6. Data retention

• Account and service data - kept while your account is active. When a server is deleted, a minimal archival record may be retained as support history.
• Billing records - kept as required by Australian tax law (generally five years).
• Email support tickets - kept while your account is active so we have context for future support.
• Live chat transcripts - closed chats are moved to an internal archive around 30 days after they end, and permanently deleted around 30 days after that. Download a transcript from your dashboard before then if you want to keep one.
• Guest chat details - the name and email a guest gives us are removed automatically once their chat transcripts are gone.
• Technical logs - short-lived operational logs, rotated on a rolling basis.
• Email records - we log that each account email was sent, so we can prove a notice reached you and avoid sending it twice. After 24 months the address and subject are automatically stripped from that log, leaving only the fact that a message of that kind was sent.
• Cookie-consent records - kept for 3 years from when the decision was made, as proof that it was given (GDPR Article 7(1)), then automatically deleted.
• Analytics events and session replays - only exist if you opted in. Our analytics provider holds analytics events for 1 year and session replays for 30 days, then deletes them. Switching analytics off stops new ones being created; ask us and we will delete the ones already held.
• Reviews - kept until you remove the review or delete your account. Removing it takes your words and name off straight away; we keep only the fact that your account posted a review (and your cards' fingerprints), so it cannot earn a second credit. Deleting your account deletes all of it.
• Help Centre feedback - your yes or no, and the daily code it is stored under, are kept for as long as that guide exists and are deleted with it. Nothing in the row points back to you or your account, so deleting your account does not reach it.
• Server panel usage - each record of a tab or button you used is deleted automatically after 180 days, and all of yours when you delete your account.
• Machine fault reports - our analytics provider holds them for 1 year, then deletes them. They name a server, not your account, so deleting your account does not reach them.
• After account deletion - personal information is deleted or de-identified, except records we must keep by law.

7. Security

All traffic, including live chat, is encrypted in transit (TLS). Data at rest is encrypted by our hosting providers. Access to customer data is restricted to the operator, full card numbers are never stored by us, and two-factor authentication is available on every account. No method of storage or transmission is completely secure, but if a data breach is likely to result in serious harm to Australian account holders we will notify you and the OAIC as required by the Notifiable Data Breaches scheme. See section 10 for the separate notification standard that applies if you are in the EEA or UK.

8. Children

The service is for adults: you must be 18 or older to create an account (see our Terms of Service). We do not knowingly collect personal information from anyone under 18 as an account holder. If you believe a minor has created an account, contact us and we will delete it.

9. Your rights (Australia)

You can download everything we hold about your account at any time from your account page - profile, subscriptions, invoices, servers, support history and cookie choices, as a machine-readable file.

Analytics events and session replays are held by our analytics provider rather than in our own database, so they are not part of that automatic download. Email us and we will export or delete them for you.

You may also request correction of your information, or ask us to delete your account and its data. Email support@playyourway.com.au from your account email address; we respond within 30 days. Deletion is handled by us rather than a self-serve button so that any active subscription is cancelled and settled first.

If you have a concern about how we have handled your information, email us first: we will look into it and reply within 30 days. If that does not resolve it, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

10. EEA and UK visitors (GDPR supplement)

If you are in the European Economic Area or the United Kingdom, this section also applies.

• Controller - PLAYYOURWAYHOSTING (ABN 33 985 231 059), Australia; contact support@playyourway.com.au.
• Legal bases - performance of a contract (your account, servers and billing); legitimate interests (service security, abuse prevention, account-activity records, the server-side product events, server panel usage records and machine fault reports in section 2, and Help Centre guide feedback, which is stored under a daily code made from your IP address rather than the address itself); consent (the optional attribution cookie, and product analytics with session replay); and legal obligation (tax and accounting records).
• Why analytics and product events are on different bases - session replay and everything else that runs in your browser stores things on your device, needs your consent, and is off until you give it. The server-side product events in section 2 store nothing on your device: they are our own records of things you did on your own account, kept on legitimate interests so we can tell whether the service works. Switching analytics off in the cookie banner therefore stops the browser half but not those records - to object to those, email us and we will stop them and delete what is held.
• Your rights - access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Access and portability are self-serve: use “Download my data” on your account page to get a structured, machine-readable copy. Where processing relies on consent you may withdraw it at any time (for cookies, via the Cookie Policy page).
• International transfers - we are an Australian business, and some of the service providers in section 5 may process data in the United States or other countries, under safeguards such as Standard Contractual Clauses. Your game server itself, with its files and backups, is hosted in the location you chose for it, which may be outside the EEA or UK. Analytics is the exception in the other direction: analytics and session-replay data is processed in the European Union (Germany) and stays there. It is still accessed by us from Australia, which is itself a transfer, and is covered by the same safeguards.
• No automated decision-making - we make no automated decisions about you that have legal or similarly significant effects.
• Breach notification - if a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
• Complaints - you may lodge a complaint with your local supervisory authority, though we would appreciate the chance to resolve it first.

11. Other regions

Wherever you are, the same principles apply: we collect only what the service needs, we do not sell personal information, and we do not share it with advertising networks. Analytics and session replay are opt-in everywhere, not only where the law requires it, and if your browser sends a Global Privacy Control signal we treat that as a no.

12. Changes

We may update this policy from time to time; the “Last updated” date above reflects the latest version. For material changes we will give notice on the site or by email.

13. Contact

Privacy questions, requests and complaints: support@playyourway.com.au. We aim to respond within 30 days.